linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Thomas Hellstrom <thellstrom@vmware.com>,
	Sinclair Yeh <syeh@vmware.com>
Subject: [PATCH 4.4 04/32] drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
Date: Mon, 10 Apr 2017 18:38:54 +0200	[thread overview]
Message-ID: <20170410163839.706528545@linuxfoundation.org> (raw)
In-Reply-To: <20170410163839.055472822@linuxfoundation.org>

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Hellstrom <thellstrom@vmware.com>

commit fe25deb7737ce6c0879ccf79c99fa1221d428bf2 upstream.

Previously, when a surface was opened using a legacy (non prime) handle,
it was verified to have been created by a client in the same master realm.
Relax this so that opening is also allowed recursively if the client
already has the surface open.

This works around a regression in svga mesa where opening of a shared
surface is used recursively to obtain surface information.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/ttm/ttm_object.c         |   10 +++++++---
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c    |    6 ++----
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c |    4 ++--
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c  |   22 +++++++++-------------
 include/drm/ttm/ttm_object.h             |    5 ++++-
 5 files changed, 24 insertions(+), 23 deletions(-)

--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -179,7 +179,7 @@ int ttm_base_object_init(struct ttm_obje
 	if (unlikely(ret != 0))
 		goto out_err0;
 
-	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
 	if (unlikely(ret != 0))
 		goto out_err1;
 
@@ -318,7 +318,8 @@ EXPORT_SYMBOL(ttm_ref_object_exists);
 
 int ttm_ref_object_add(struct ttm_object_file *tfile,
 		       struct ttm_base_object *base,
-		       enum ttm_ref_type ref_type, bool *existed)
+		       enum ttm_ref_type ref_type, bool *existed,
+		       bool require_existed)
 {
 	struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
 	struct ttm_ref_object *ref;
@@ -345,6 +346,9 @@ int ttm_ref_object_add(struct ttm_object
 		}
 
 		rcu_read_unlock();
+		if (require_existed)
+			return -EPERM;
+
 		ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref),
 					   false, false);
 		if (unlikely(ret != 0))
@@ -635,7 +639,7 @@ int ttm_prime_fd_to_handle(struct ttm_ob
 	prime = (struct ttm_prime_object *) dma_buf->priv;
 	base = &prime->base;
 	*handle = base->hash.key;
-	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
 
 	dma_buf_put(dma_buf);
 
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -1144,10 +1144,8 @@ int vmw_fence_event_ioctl(struct drm_dev
 		(void) vmw_fence_obj_reference(fence);
 
 		if (user_fence_rep != NULL) {
-			bool existed;
-
-			ret = ttm_ref_object_add(tfile, base,
-						 TTM_REF_USAGE, &existed);
+			ret = ttm_ref_object_add(vmw_fp->tfile, base,
+						 TTM_REF_USAGE, NULL, false);
 			if (unlikely(ret != 0)) {
 				DRM_ERROR("Failed to reference a fence "
 					  "object.\n");
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -591,7 +591,7 @@ static int vmw_user_dmabuf_synccpu_grab(
 		return ret;
 
 	ret = ttm_ref_object_add(tfile, &user_bo->prime.base,
-				 TTM_REF_SYNCCPU_WRITE, &existed);
+				 TTM_REF_SYNCCPU_WRITE, &existed, false);
 	if (ret != 0 || existed)
 		ttm_bo_synccpu_write_release(&user_bo->dma.base);
 
@@ -775,7 +775,7 @@ int vmw_user_dmabuf_reference(struct ttm
 
 	*handle = user_bo->prime.base.hash.key;
 	return ttm_ref_object_add(tfile, &user_bo->prime.base,
-				  TTM_REF_USAGE, NULL);
+				  TTM_REF_USAGE, NULL, false);
 }
 
 /*
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -904,17 +904,16 @@ vmw_surface_handle_reference(struct vmw_
 	uint32_t handle;
 	struct ttm_base_object *base;
 	int ret;
+	bool require_exist = false;
 
 	if (handle_type == DRM_VMW_HANDLE_PRIME) {
 		ret = ttm_prime_fd_to_handle(tfile, u_handle, &handle);
 		if (unlikely(ret != 0))
 			return ret;
 	} else {
-		if (unlikely(drm_is_render_client(file_priv))) {
-			DRM_ERROR("Render client refused legacy "
-				  "surface reference.\n");
-			return -EACCES;
-		}
+		if (unlikely(drm_is_render_client(file_priv)))
+			require_exist = true;
+
 		if (ACCESS_ONCE(vmw_fpriv(file_priv)->locked_master)) {
 			DRM_ERROR("Locked master refused legacy "
 				  "surface reference.\n");
@@ -942,17 +941,14 @@ vmw_surface_handle_reference(struct vmw_
 
 		/*
 		 * Make sure the surface creator has the same
-		 * authenticating master.
+		 * authenticating master, or is already registered with us.
 		 */
 		if (drm_is_primary_client(file_priv) &&
-		    user_srf->master != file_priv->master) {
-			DRM_ERROR("Trying to reference surface outside of"
-				  " master domain.\n");
-			ret = -EACCES;
-			goto out_bad_resource;
-		}
+		    user_srf->master != file_priv->master)
+			require_exist = true;
 
-		ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+		ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL,
+					 require_exist);
 		if (unlikely(ret != 0)) {
 			DRM_ERROR("Could not add a reference to a surface.\n");
 			goto out_bad_resource;
--- a/include/drm/ttm/ttm_object.h
+++ b/include/drm/ttm/ttm_object.h
@@ -229,6 +229,8 @@ extern void ttm_base_object_unref(struct
  * @ref_type: The type of reference.
  * @existed: Upon completion, indicates that an identical reference object
  * already existed, and the refcount was upped on that object instead.
+ * @require_existed: Fail with -EPERM if an identical ref object didn't
+ * already exist.
  *
  * Checks that the base object is shareable and adds a ref object to it.
  *
@@ -243,7 +245,8 @@ extern void ttm_base_object_unref(struct
  */
 extern int ttm_ref_object_add(struct ttm_object_file *tfile,
 			      struct ttm_base_object *base,
-			      enum ttm_ref_type ref_type, bool *existed);
+			      enum ttm_ref_type ref_type, bool *existed,
+			      bool require_existed);
 
 extern bool ttm_ref_object_exists(struct ttm_object_file *tfile,
 				  struct ttm_base_object *base);

  parent reply	other threads:[~2017-04-10 16:40 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-04-10 16:38 [PATCH 4.4 00/32] 4.4.61-stable review Greg Kroah-Hartman
2017-04-10 16:38 ` [PATCH 4.4 01/32] drm/vmwgfx: Type-check lookups of fence objects Greg Kroah-Hartman
2017-04-10 16:38 ` [PATCH 4.4 02/32] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Greg Kroah-Hartman
2017-04-10 16:38 ` [PATCH 4.4 03/32] drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() Greg Kroah-Hartman
2017-04-10 16:38 ` Greg Kroah-Hartman [this message]
2017-04-10 16:38 ` [PATCH 4.4 05/32] drm/vmwgfx: Remove getparam error message Greg Kroah-Hartman
2017-04-10 16:38 ` [PATCH 4.4 06/32] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Greg Kroah-Hartman
2017-04-10 16:38 ` [PATCH 4.4 07/32] sysfs: be careful of error returns from ops->show() Greg Kroah-Hartman
2017-04-10 16:38 ` [PATCH 4.4 08/32] staging: android: ashmem: lseek failed due to no FMODE_LSEEK Greg Kroah-Hartman
2017-04-10 16:38 ` [PATCH 4.4 09/32] arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 10/32] arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 11/32] iio: bmg160: reset chip when probing Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 12/32] Reset TreeId to zero on SMB2 TREE_CONNECT Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 13/32] ptrace: fix PTRACE_LISTEN race corrupting task->state Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 14/32] ring-buffer: Fix return value check in test_ringbuffer() Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 15/32] metag/usercopy: Drop unused macros Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 16/32] metag/usercopy: Fix alignment error checking Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 17/32] metag/usercopy: Add early abort to copy_to_user Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 18/32] metag/usercopy: Zero rest of buffer from copy_from_user Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 19/32] metag/usercopy: Set flags before ADDZ Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 20/32] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 21/32] metag/usercopy: Add missing fixups Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 22/32] powerpc/mm: Add missing global TLB invalidate if cxl is active Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 23/32] powerpc: Dont try to fix up misaligned load-with-reservation instructions Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 24/32] nios2: reserve boot memory for device tree Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 25/32] s390/decompressor: fix initrd corruption caused by bss clear Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 26/32] s390/uaccess: get_user() should zero on failure (again) Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 27/32] MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels Greg Kroah-Hartman
2017-04-14 23:45   ` Maciej W. Rozycki
2017-04-19 13:13     ` Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 28/32] MIPS: ralink: Fix typos in rt3883 pinctrl Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 29/32] MIPS: End spinlocks with .insn Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 30/32] MIPS: Lantiq: fix missing xbar kernel panic Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 31/32] MIPS: Flush wrong invalid FTLB entry for huge page Greg Kroah-Hartman
2017-04-10 16:39 ` [PATCH 4.4 32/32] mm/mempolicy.c: fix error handling in set_mempolicy and mbind Greg Kroah-Hartman
2017-04-10 20:38 ` [PATCH 4.4 00/32] 4.4.61-stable review Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170410163839.706528545@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=syeh@vmware.com \
    --cc=thellstrom@vmware.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).